Is this PDF broken, or hiding anything risky?
The validator runs ten quick checks. It confirms the file is a real PDF that opens, reads its dates and software, and looks for scripts, auto-run actions, attachments and launch commands in the first 2 MB. In our test, a file with a script that runs on opening passed with 2 warnings. It does not scan for viruses.
Can a PDF have a virus?
A PDF can carry scripts, attachments and instructions to open other programs, which is how harmful PDFs work. This check flags those features in the first 2 MB of the file. A flag means the feature is there, not that it is harmful: date pickers and print buttons use scripts too. It is not an antivirus scan.
How do I know if a PDF is corrupted?
If the file cannot be opened, the check stops and says so. A copy cut off after 400 bytes returned "This PDF appears to be corrupted or damaged." An HTML page or an image saved with a .pdf name is caught too. Passing does not prove that every part of the file is well formed.
Does this check PDF/A or accessibility?
No. Passing all ten checks means the file opened, had believable details and showed no risky features in the sample. It says nothing about PDF/A, accessibility or signatures. Use the PDF/A validator, the accessibility checker or the signature checker for those.
Each check, what passes it, and the wording you will see
The screening reads the file's properties with pdfinfo, looks for an XMP packet and samples the first 2 MB of raw bytes for risky markers. It then runs ten checks. Two of them, Modification Status and Content Analysis, always pass and only add information.
| Check | Passes when | Other messages |
|---|---|---|
| PDF File Type | The detected MIME type is application/pdf |
File type may not be PDF |
| Creation Date | A creation date could be parsed | No creation date found in metadata |
| Date Reliability | Date confidence is high | Some date quality issues detected (medium); Date metadata may not be reliable (low) |
| Creator Information | Creator software or an author is recorded | No creator/author information found |
| Software Identification | A creator or producer name is recorded, known to the catalogue or not | Could not identify creation software |
| Modification Status | Always passes; a warning is added when the file was modified | Modified 1 day, 18 hours, 45 minutes (example) |
| AI Generation Check | The AI-generator indicator score is below 25 | The indicator summary, for example a ReportLab match at 55/100 |
| Content Analysis | Always passes (informational) | Could not determine content type |
| Page Structure | A page count above zero was read | Could not determine page count |
| Risky Content Check | No risky marker was found in the sample | Found potential security risks: followed by the markers |
How warnings become the overall verdict
Four situations add a warning: date reliability below high, a modification after creation, an AI-generator score of 25 or more, and any risky marker. The file is reported as passing basic checks when its type is PDF and it has fewer than three warnings. The summary then reads "PDF passed all basic checks with no warnings." or "PDF passed basic checks with 2 warning(s). Review the details below." With three or more warnings it takes the form "Basic checks found N issue(s) and N warning(s). Please review carefully."
The full report also shows a Document health number. It counts checks that passed cleanly as one, checks with a warning as half, divides by the number of checks and converts to a percentage. A file with an AI-generator score of 25 or more is capped at 65. Scores from 80 are labelled Good, 55 to 79 Review Suggested, and below 55 Issues Found.
Risky markers in the 2 MB sample
The marker search looks for PDF name tokens in the raw bytes. It does not run or decode anything, and markers inside compressed object streams or beyond the first 2 MB are not seen. A marker means a feature is present, not that it is malicious.
| Marker found | Points | What it usually is |
|---|---|---|
/JavaScript or /JS |
20 | Form calculations, date pickers, print buttons, or a script that runs on open |
/OpenAction |
10 | What the viewer does on opening: often just "go to page 1 at fit width" |
/EmbeddedFile or /Filespec |
10 | Attachments, such as the XML data inside e-invoice PDFs, or references to other files |
/Launch |
50 | An instruction to open another file or program; rare in ordinary documents |
Measured: a file that opens with a script
We added an OpenAction running app.alert(1) to a one-page test file. pdfinfo: JavaScript: yes Findings: Contains JavaScript action markers, Contains OpenAction markers (30 points) Risky Content Check: Found potential security risks: Contains JavaScript action markers, Contains OpenAction markers Summary: PDF passed basic checks with 2 warning(s). Review the details below. Document health: 90
When the file is refused before checking
Every upload passes a safety screen before any check runs. These are the messages it can return, and the usual cause of each.
A file that passes the screen but cannot be opened is stopped before any check runs, and no report is saved. pdfinfo decides: a copy locked with an open password returns "This PDF is password-protected. Please unlock it first or use our Password Unlock tool." and a copy cut off after 400 bytes returns "This PDF appears to be corrupted or damaged. Please try a different file." Before this check, both produced an almost empty report with four failed checks. Remove the password or obtain an undamaged copy and check again.
- "The file is too small to be a valid PDF." The upload is under 128 bytes, typically an interrupted download.
- "The file does not contain a valid PDF header (missing %PDF- signature)." The first kilobyte does not contain
%PDF-; the file is often an HTML error page or an image saved with a .pdf name. - "The file appears to be a ZIP archive disguised as a PDF." Office documents and archives are ZIP containers; export the document to PDF first.
- "The file contains an embedded Windows executable and cannot be processed." An executable signature appears at the start of a file that does not begin with a PDF header.
Reading the results correctly
Content Analysis shows "Could not determine content type" for single uploads, because this fast path does not extract page text. That message is expected and does not lower the verdict. Use text extraction when you need to know whether pages contain real text or only scanned images.
Passing all ten checks means the file opened, carried plausible metadata and showed no risky markers in the sample. It does not mean every object in the file is well formed, that every page renders, or that the file meets PDF/A, PDF/UA or signature requirements. Those need the dedicated checks linked beside this section.
Last updated . Messages are quoted from the checker's source code. The sample results were produced on 12 October 2026 by running the same screening service locally, with Poppler pdfinfo 26.10.0, on synthetic test PDFs we built for the purpose.